Repository navigation
LAB 27 (Encrypt Boot Volume with Custom Managed Keys)
Encrypting a boot volume with Customer-Managed Keys (CMKs) in OCI (Oracle Cloud Infrastructure) is a powerful way to maintain control over your data security.
By default, OCI encrypts boot volumes with Oracle-managed keys.
With CMKs, you own the keys — meaning you decide when to rotate, disable, or revoke them.
If the key is disabled, the boot volume becomes inaccessible, giving you ultimate control over data exposure.
Many industries (finance, healthcare, government) require customer-controlled encryption keys to meet standards like:
-
GDPR
-
HIPAA
-
PCI-DSS
Using CMKs ensures you meet these strict compliance mandates.
-
Security teams often want to separate data ownership from cloud provider control.
-
CMKs allow you to enforce that only authorized groups can use/decrypt volumes, independent of Oracle’s default key management.
-
You can rotate keys periodically to reduce risk.
-
You can audit key usage via OCI Vault logs.
-
You can disable or delete keys if a workload is retired, ensuring data is permanently inaccessible.
-
In large organizations, different teams may need different encryption policies.
-
CMKs let you assign specific keys per compartment/project, aligning with enterprise governance.
When me click on assign button that time an error comes in front of us due to permission not granted for do this. so we first create policy to give permission.
Now we add this policy
allow service blockstorage to use keys in compartment Hub_Compute_and_storage_compartment
after adding policy we try to assign key again.
Now we successfully assign key to boot volume.
